Anomaly detection with changing cluster centers

Abstract

In view of the complexity of information system environment and the diversity of security requirements, many scholars proposed intrusion detection methods based on outlier mining. In order to meet the security requirement of condition guarantee information system, this paper proposes an anomaly detection with changing cluster centers (ADCCC). The rough set algorithm is used to reduce the sample set, and the number of sample repeats is determined on the basis of the duplicated degrees. The algorithm determines whether the sample is an outlier sample, mainly by changing the cluster center before and after adding a sample. Based on the overall deviation degree of the sample set, we can determine whether the sample set is an anomaly sample. Experimental results show that ADCCC algorithm has higher detection rate for anomaly detection.